IBM Support

IJ21228: TOMCAT OUT OF MEMORY CAN OCCUR DURING AUTOMATED REFERENCE DATA CLEANUP BY QRADAR

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that in some instances, the tomcat
    process can experience an Out of Memory occurance during
    QRadar's automated cleanup of reference data.
    The QRadar User Interface is unavailable during
    a tomcat Out Of Memory occurance until the affected services
    recover.
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occuring:
    com.q1labs.core.shared.referencedata.ReferenceDataManager:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/-
    -]ReferenceDataManager.deleteFromReferenceDataCollection() -
    SQLException caught while trying to delete from Reference Data
    Collection : UBA : User Accounts, Successful, Recent
    com.q1labs.core.shared.referencedata.ReferenceDataManager:
    [ERROR] Chained SQL Exception [1/2]: Batch entry 0 delete from
    reference_data_element rde where rde.rdk_id = (select id from
    reference_data_key where rd_id = 53 and domain_info =
    2147483647) and data= ? was aborted: An I/O error occurred
    while sending to the backend.  Call getNextException to see
    other errors in the batch.
    com.q1labs.core.shared.referencedata.ReferenceDataManager:
    [ERROR] Chained SQL Exception [2/2]: An I/O error occurred
    while sending to the backend.
    com.q1labs.core.shared.referencedata.ReferenceDataManager:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/-
    -]ReferenceDataManager.deleteFromReferenceDataCollection()
    getNextException() :
    java.sql.BatchUpdateException: Batch entry 0 delete from
    reference_data_element rde where rde.rdk_id = (select id from
    reference_data_key where rd_id = 53 and domain_info =
    2147483647) and data = ? was aborted: An I/O error occurred
    while sending to the backend.  Call getNextException to see
    other errors in the batch.
       at
    org.postgresql.jdbc.BatchResultHandler.handleError(BatchResultHa
    ndler.java:148)
       at
    org.postgresql.jdbc.PgStatement.executeBatch(PgStatement.java:81
    9)
       at
    org.postgresql.jdbc.PgPreparedStatement.executeBatch(PgPreparedS
    tatement.java:1556)
       at
    com.mchange.v2.c3p0.impl.NewProxyPreparedStatement.executeBatch(
    NewProxyPreparedStatement.java:1723)
       at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.executeB
    atch(DelegatingPreparedStatement.java:250)
       at
    org.apache.openjpa.lib.jdbc.LoggingConnectionDecorator$LoggingCo
    nnection$LoggingPreparedStatement.executeBatch(LoggingConnection
    Decorator.java:1149)
       at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.executeB
    atch(DelegatingPreparedStatement.java:250)
       at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.executeB
    atch(DelegatingPreparedStatement.java:250)
       at
    org.apache.openjpa.lib.jdbc.DelegatingPreparedStatement.executeB
    atch(DelegatingPreparedStatement.java:250)
       at
    org.apache.openjpa.jdbc.kernel.JDBCStoreManager$CancelPreparedSt
    atement.executeBatch(JDBCStoreManager.java:1809)
       at
    com.q1labs.frameworks.session.PreparedStatementWrapper.executeBa
    tch(PreparedStatementWrapper.java:265)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet.ru
    nSqlStatement(ReferenceDataCacheSet.java:494)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet.de
    leteData(ReferenceDataCacheSet.java:576)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet.ac
    cess$800(ReferenceDataCacheSet.java:36)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet$5.
    call(ReferenceDataCacheSet.java:273)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet$5.
    call(ReferenceDataCacheSet.java:251)
       at
    com.q1labs.core.dao.referencedata.light.RefDataCacheLock.writeCa
    cheAccess(RefDataCacheLock.java:125)
       at
    com.q1labs.core.dao.referencedata.light.ReferenceDataCacheSet.de
    leteElement(ReferenceDataCacheSet.java:250)
       at
    com.q1labs.core.dao.referencedata.light.RefDataDomainProtection.
    deleteElement(RefDataDomainProtection.java:83)
       at
    com.q1labs.core.shared.referencedata.ReferenceDataManager.delete
    FromReferenceDataCollection(ReferenceDataManager.java:885)
       at
    com.q1labs.core.shared.referencedata.ReferenceDataManager.delete
    FromReferenceDataCollection(ReferenceDataManager.java:946)
       at
    com.q1labs.core.shared.referencedata.ReferenceDataTimer.expireDa
    ta(ReferenceDataTimer.java:186)
       at
    com.q1labs.core.shared.referencedata.ReferenceDataTimer.timeExpi
    red(ReferenceDataTimer.java:68)
       at
    com.q1labs.frameworks.events.timer.TimerEventGenerator$TimerEven
    tInfo.dispatchEvent(TimerEventGenerator.java:234)
       at
    com.q1labs.frameworks.events.SequentialEventDispatcher$DispatchT
    hread.run(SequentialEventDispatcher.java:129)
    Caused by:
    org.postgresql.util.PSQLException: An I/O error occurred while
    sending to the backend.
       at
    org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorIm
    pl.java:333)
       at
    org.postgresql.jdbc.PgStatement.executeBatch(PgStatement.java:81
    6)
       ... 23 more
    Caused by:
    java.net.SocketException: Socket closed
       at java.net.SocketInputStream.socketRead0(Native Method)
       at
    java.net.SocketInputStream.socketRead(SocketInputStream.java:127
    )
       at
    java.net.SocketInputStream.read(SocketInputStream.java:182)
       at
    java.net.SocketInputStream.read(SocketInputStream.java:152)
    

Local fix

  • Contact Support for a possible workaround that might address
    this issue in some instances.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 7.4.1.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 7.4.1.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ21228

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-11-27

  • Closed date

    2020-08-06

  • Last modified date

    2020-08-06

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU029","label":"Software"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
12 August 2020